The 'finance-business-company-id-models' npm package version 20.1.5 includes malicious code that, upon require(), loads scripts that reconstruct obfuscated hostnames to fetch platform-specific binaries from multiple external domains. These binaries are saved under disguised filenames in temporary directories, given executable permissions, and executed detached without any hash or signature verification. The package also contains a secondary dropper that assembles and executes additional payloads. The network destinations, obfuscation techniques, and execution methods are inconsistent with the package's legitimate purpose, indicating a supply-chain dropper campaign. Systems with this package installed are fully compromised.

Systems with this package installed are fully compromised, as the malicious code downloads and executes arbitrary binaries with no verification, potentially allowing complete attacker control. All secrets and keys stored on affected systems should be considered exposed and must be rotated immediately. Removing the package alone does not guarantee removal of all malicious components or attacker persistence.

Immediate removal of the 'finance-business-company-id-models' package version 20.1.5 is required. All secrets and keys on affected systems should be rotated from a separate, trusted environment. Due to the full compromise risk, a full system investigation and remediation may be necessary. No official patch or fix is currently available; patch status is not yet confirmed — check the vendor advisory for updates.